Malicious actors continue to exploit vulnerabilities not just directly at companies but also at software providers and vendors to infiltrate organizations’ networks. Recent data shows that about 35.5% of last year’s data breaches happened due to third-party compromises, representing an increase of 6.5% from 2023. However, this figure is likely more significant, as third-party data breaches are not always disclosed. And yet, they represent a threat to organisations, as bad actors use the systems of third-party vendors to access and steal sensitive data from companies.
Nowadays, outsourcing business processes to vendors has become a common practice for companies, and for good reason, as suppliers, vendors, and partners are essential to ensuring seamless operations, such as storing sensitive data or benefiting from cloud services.
However, third parties also represent a significant source of cyber risk, and to propel growth, it’s essential to try to prevent a third-party breach by adopting the best practices that we will discuss in this blog.
Understanding Third-Party Data Breaches
Third-party data breaches occur when a third-party organization’s system is compromised, typically through a supplier or vendor. Once this happens, bad actors can steal data from companies. Third parties are not under a company’s control, and most of the time, they do not offer full transparency regarding their data security controls.
And while some vendors may have strong security standards in place, this doesn’t apply to all of them. According to a 2019 survey, 44% of the companies that participated in the survey faced data breaches due to a third-party vendor, leading to significant financial consequences. As reports have found, it’s never good news when data breaches happen due to third parties’ vulnerabilities because the cost tends to be more significant, surpassing $90,000. Unfortunately, this type of data breach is becoming more and more frequent, as in the last year, about 98% of companies experienced such an incident. This shows your company could easily be at risk, and for this reason, prevention should be a priority in order to avoid reputational damage, financial losses, loss of consumer trust, and other negative outcomes associated with third-party data breaches.
Companies That Suffered a Third-Party Data Breach
Third-party data breaches are often associated with the healthcare sector, but they happen across all industries, from financial institutions and critical infrastructure to governmental agencies. Below, we look at some companies that faced third-party data breaches and the consequences that followed the incident.
Trinity Health
Trinity Health is one of the companies that has faced significant third-party data breaches in 2020 and 2021, respectively. In 2020, Blackbaud, the vendor responsible for managing the donor database of Trinity Health, faced a ransomware attack, and as a consequence, the records of 3.3 million patients were compromised.
Trinity Health tried to take action against the attack, but cybercriminals still succeeded in accessing sensitive data, and the healthcare provider was left with no other choice but to pay the ransom. In 2021, it suffered another third-party data breach due to a cyber-attack on Accellion, and the data compromised included financial information, dates of birth, medications, full contact details and names, and lab test results, to name a few.
SolarWinds
SolarWinds is another excellent example of the far-reaching consequences of a third-party data breach, as over 18,000 software users were affected by the incident, including government agencies, such as the Department of Defense, the Department of Homeland Security, and the Treasury Department, to name a few.
Not only that, but the data breach also had a negative impact on the functionality of many large private companies, from Microsoft and Intel to Cisco. Due to this incident, the Trump administration was motivated to improve the nation’s cybersecurity capabilities.
Mercedes-Benz
Third-party data breaches affect industries beyond the healthcare sector, and Mercedes-Benz is a testament to that. In June 2021, the company released information about an incident that occurred from 2014 to 2017 and impacted about 1.6 million records. The target of the attack was the vendor’s cloud storage platform.
In the aftermath of the incident, data on customers was leaked from websites, compromising data of 1000 people, including their emails, full names, phone numbers, driver’s license numbers, birth dates, and data about purchased vehicles, to name a few.
Be Proactive, Not Reactive
Many companies take a reactive approach to data breaches, which means they respond to the incident after it has already happened. This approach involves identifying the source of the attack and taking action to prevent such incidents from happening again in the future, and a lack of preparation characterizes it. Unsurprisingly, this approach can cause increased damage to the company, as consumers not only lose trust but also claim compensation for data breach, which can lead to financial impacts ranging from only a few hundred thousand dollars for smaller organisations to millions for larger companies.
To avoid these consequences, your company should embrace a proactive incident response approach, which focuses on implementing measures that allow you to mitigate potential risks. This can result in a faster response time, thus causing minimal damage to the company.
Evaluate Your Vendors Before Onboarding Them
Once third-party vendors are onboard, they will have access to your company’s data, so it’s paramount to measure the cybersecurity risk they introduce. Unfortunately, many organisations overlook the importance of taking this step during the vendor selection process, which leaves them vulnerable to cyber threats.
A simple way to evaluate a potential vendor is to use security ratings, which are a widely used tool due to their practicality, as they can replace and supplement vendor risk-assessment methods, such as on-site visits, questionnaires, or penetration tests, all of which can be
time-consuming. By employing security ratings, you can immediately understand a potential vendor’s security posture and the cyber threats that they may be prone to, which decreases the operational burden on third-party risk management teams.
Include Risk Management in Your Vendor Contracts
Another good practice is to make cyber risk a part of your vendor contracts, as this will allow you to hold vendors accountable in case their security posture becomes less and less robust. Note, however, that this doesn’t necessarily mean a third-party breach won’t happen.
Incorporating security ratings into vendor contracts can be approached in several ways, such as stipulating that a vendor who manages sensitive data, like credit cards or personal information, must ensure a security rating beyond 900 so that the contract won’t be terminated.
Monitor Vendors’ Security Posture Continuously
Questionnaires and surveys are helpful tools that can offer insights into a vendor’s security posture, but they can only go so far. They don’t provide the whole picture, and many times, the accuracy of questionnaires can’t be verified, leaving no other option but to accept the word of a third party that they are indeed compliant. However, it can be risky to rely only on their words, and since a vendor’s security posture will likely change throughout the course of the contract, it’s paramount to continuously monitor it by using adequate tools such as third-party risk management software, vulnerability scanners, or intrusion detection systems.
This way, you can prevent major issues, get notified when a vendor isn’t compliant, and detect problems they may not even be aware of. This real-time visibility will ensure faster response to potential cybersecurity threats, thus reducing your exposure and allowing you to take immediate action whenever needed.
Use Automated Tools to Save Money and Time
Due diligence can be a tedious process when it comes to decreasing third-party risk, given that major companies work with hundreds or thousands of third parties. This means they have a lot to keep track of, and it can be complex, especially because many companies still use manual tools to monitor TPRM. Not only can this process take up a lot of time, but it’s also prone to errors.
Instead, your company should use automated tools as they help decrease paperwork and strain that staff can experience, thus providing a more seamless way to monitor third parties without the need to update spreadsheets or create questionnaires. Besides, vendors often deal with questionnaire fatigue, which happens because they need to fill out many risk assessment questionnaires. Thankfully, automated tools can reduce the administrative work on the vendor’s end.
Break Off Relationships With Bad Vendors
Suppose a third-party vendor can’t meet your standards or they have faced a data breach; it’s essential to ask yourself whether you want to continue working with them. If the answer is yes, consider whether you have the processes in place to offboard the vendor without causing significant disruption to your business operations.
While onboarding vendors is not so complicated for most companies, things are different when it comes to offboarding them, and many organisations struggle with the process. To ensure the complete protection of your company, you need to prioritise proper offboarding by using a personalized approach and meeting the specific needs and requirements of each vendor. Furthermore, it’s essential to update internal documentation, which involves removing references to the vendor, as well as reviewing dependencies, and addressing them promptly by switching to alternative solutions to ensure business continuity.
Conclusion
Third-party data breaches are a serious threat to organisations, and as the latest data shows, they have only been on the rise. Their consequences can go as far as destroying a company due to legal battles, significant financial impacts, and damaged reputation. So, suppose your company hasn’t yet developed a plan for third-party risk management.
In that case, it’s time to take immediate action and follow the practices discussed in the blog, including evaluating vendors before onboarding, incorporating risk management in vendors’ contracts, monitoring security postures continuously, and automating processes. This will help you significantly reduce the risks associated with a third-party breach, ensuring your business’s long-term success.
Not sure if you're the bottleneck? Find out in 2 minutes →
